Yes, it's a problem. That's why such lists must be deny all by default in the browser, and you only set allow lists for the stuff you want.